@intentius/chant-lexicon-k8s 0.124.31 → 0.124.32

package/dist/generated/runtime.js

@@ -0,0 +1,4 @@
+/**
+ * Runtime factory constructors — re-exported from core.
+ */
+export { createResource, createProperty } from "@intentius/chant/runtime";

package/dist/group-namespace.js

@@ -0,0 +1,96 @@
+/**
+ * API group → `K8s::{Namespace}::{Kind}` namespace segment — the ONE copy.
+ *
+ * Four surfaces build entityTypes from a group string: CRD codegen
+ * (`crd/parser.ts`), the swagger pass (`spec/parse.ts`), live discovery
+ * (`describe-resources.ts` via `gvkToTypeName`), and YAML import
+ * (`import/parser.ts`). Until #1628 each had its own copy of the rule and only
+ * CRD codegen consulted the overrides, so a Flux Kustomization arriving through
+ * a kustomize root or `chant import` was typed `K8s::Kustomize::Kustomization`
+ * — a name that matches nothing in operations.json (NOT-OBSERVED live) and
+ * nothing downstream that dispatches on kind. Every path resolves here now;
+ * the declared, rendered, imported and discovered spellings of a kind cannot
+ * skew.
+ */
+/**
+ * Group names whose first segment doesn't yield the conventional namespace.
+ * "argoproj.io" → "Argo" (not "Argoproj") to match the Argo CD vocabulary
+ * and the ArgoAppFor / ArgoAppSetForRegions composites.
+ *
+ * The Flux toolkit spreads across five `*.toolkit.fluxcd.io` groups plus the
+ * Flux Operator's `fluxcd.controlplane.io`; all six collapse to a single `Flux`
+ * namespace so a GitRepository and a Kustomization read as `K8s::Flux::*`
+ * siblings rather than scattering to Source / Kustomize / Helm / Notification /
+ * Image / Fluxcd. (`helm.toolkit.fluxcd.io` → `Helm` would also collide
+ * confusingly with the separate helm lexicon.)
+ *
+ * KubeMicroVM's `lambda.aws.amazon.com` would take `Lambda` by the
+ * first-segment rule, which reads as AWS Lambda proper and would sit
+ * confusingly beside the aws lexicon's real Lambda functions. These are
+ * Kubernetes CRs belonging to a community operator, so they take the
+ * operator's own name. `MicroVM` alone was the alternative and was rejected
+ * for stuttering: `K8s::MicroVM::MicroVM`.
+ *
+ * Note the official AWS controller uses a different group,
+ * `lambdamicrovms.services.k8s.aws`, so it can coexist here and will want its
+ * own entry rather than sharing this one.
+ */
+export const GROUP_NAMESPACE_OVERRIDES = {
+    "argoproj.io": "Argo",
+    "source.toolkit.fluxcd.io": "Flux",
+    "kustomize.toolkit.fluxcd.io": "Flux",
+    "helm.toolkit.fluxcd.io": "Flux",
+    "notification.toolkit.fluxcd.io": "Flux",
+    "image.toolkit.fluxcd.io": "Flux",
+    "fluxcd.controlplane.io": "Flux",
+    "lambda.aws.amazon.com": "KubeMicroVM",
+    // CNPG and its barman-cloud plugin ship under two groups but are one thing to
+    // an author: a Cluster's `plugins[]` names an ObjectStore. The first-segment
+    // rule would scatter them into `Postgresql` and `Barmancloud`.
+    "postgresql.cnpg.io": "Cnpg",
+    "barmancloud.cnpg.io": "Cnpg",
+    // Not `Secrets`: `K8s::Secrets::InfisicalSecret` reads like a core Secret,
+    // and `K8s::Core::Secret` is right there to be confused with.
+    "secrets.infisical.com": "Infisical",
+    // k3s's bundled controllers ship under two groups but are one thing to an
+    // author — the k3s auto-deploy surface. The first-segment rule would give
+    // `K8s::Helm::HelmChart`, which reads like it belongs to the helm lexicon,
+    // and would split HelmChart from the Addon that tracks its deployment.
+    "helm.cattle.io": "K3s",
+    "k3s.cattle.io": "K3s",
+    // The first-segment rule would give `Serving`, which reads like a generic
+    // core concept rather than the KServe operator that owns it.
+    "serving.kserve.io": "KServe",
+    // The first-segment rule would give `Cluster`, which stutters against the
+    // CAPI `Cluster` kind itself (`K8s::Cluster::Cluster`) the same way the
+    // rejected `K8s::MicroVM::MicroVM` reads above. `infrastructure.cluster.x-k8s.io`
+    // (CAPA's AWSManagedCluster, AWSManagedMachinePool, AWSClusterControllerIdentity)
+    // and `controlplane.cluster.x-k8s.io` (CAPA's AWSManagedControlPlane) are left on
+    // the first-segment rule — their kinds already carry an `AWS` prefix, so
+    // `K8s::Infrastructure::AWSManagedCluster` / `K8s::Controlplane::AWSManagedControlPlane`
+    // don't need the same rescue. `addons.cluster.x-k8s.io` (CAAPH's HelmChartProxy,
+    // core CAPI's ClusterResourceSet) likewise stays `Addons`.
+    "cluster.x-k8s.io": "CAPI",
+    // The first-segment rule would give `Opentelemetry`, which misspells the
+    // product (OpenTelemetry is one word with two capitals) and leaves the
+    // operator's kinds as `K8s::Opentelemetry::OpenTelemetryCollector`.
+    "opentelemetry.io": "OpenTelemetry",
+};
+/**
+ * Normalize an API group to its PascalCase namespace segment.
+ * "" → "Core", overrides first ("argoproj.io" → "Argo"), then the first
+ * dot-segment kebab→PascalCased: "cert-manager.io" → "CertManager",
+ * "rbac.authorization.k8s.io" → "Rbac", "apps" → "Apps".
+ */
+export function namespaceSegmentForGroup(group) {
+    if (!group || group === "")
+        return "Core";
+    const override = GROUP_NAMESPACE_OVERRIDES[group];
+    if (override)
+        return override;
+    const firstSegment = group.split(".")[0];
+    return firstSegment
+        .split("-")
+        .map((s) => s.charAt(0).toUpperCase() + s.slice(1))
+        .join("");
+}

package/dist/import/embedded.js

@@ -0,0 +1,197 @@
+/**
+ * Where a Kubernetes manifest embeds another lexicon's content, for
+ * `chant import` (#2962).
+ *
+ * The parser offers two kinds of place to core's embedded-content resolver:
+ *
+ * - every `data` value of a ConfigMap, as text (a collector's `config.yaml`,
+ *   a Prometheus rule file, an `alertmanager.yml`, a Grafana dashboard's
+ *   JSON);
+ * - a `monitoring.coreos.com` PrometheusRule's `spec.groups`, as the rule file
+ *   `{ groups }` those groups would make;
+ * - an OpenTelemetry Operator `OpenTelemetryCollector`'s `spec.config` (v1beta1,
+ *   a structured object), offered as `{ config, header }` with the `# chant:`
+ *   header lines kept in the `otel.chant.dev/header` annotation (#3367);
+ * - a Grafana Operator `GrafanaDashboard`'s `spec.json`, as text (#3015);
+ * - the alerting content of the Grafana Operator's `GrafanaAlertRuleGroup`
+ *   (`spec.rules`), `GrafanaContactPoint` (`spec.receivers`),
+ *   `GrafanaNotificationPolicy` (`spec.route`), `GrafanaNotificationPolicyRoute`
+ *   (the whole `spec`, offered as `route`), `GrafanaMuteTiming`
+ *   (`spec.time_intervals`) and `GrafanaNotificationTemplate`
+ *   (`spec.template`), each with the whole `spec` as the document so the
+ *   owner can read the fields beside it (#3538).
+ *
+ * Which lexicon imports the content is decided by core at run time, from the
+ * lexicons that register an `embeddedImporters()`; this module names none of
+ * them as a dependency. The `expectedOwner` hints below are the conventions
+ * k8s manifests follow, used only to warn when the owner is not installed.
+ */
+import { embeddedDocument } from "@intentius/chant/import/embedded";
+function isObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** The annotation `OtelCollectorCR` keeps the collector config's `# chant:` header lines in (see OTEL_COLLECTOR_ANNOTATIONS). */
+const OTEL_HEADER_ANNOTATION = "otel.chant.dev/header";
+/** The `grafana_dashboard` label the Grafana dashboard sidecar looks for (kube-prometheus-stack, the Grafana Helm chart). */
+export const GRAFANA_DASHBOARD_LABEL = "grafana_dashboard";
+/** The Grafana Operator alerting kinds, and the `spec` field holding what the grafana lexicon imports. */
+const GRAFANA_ALERTING_FIELDS = {
+    "K8s::Grafana::GrafanaAlertRuleGroup": { field: "rules", what: "Grafana alert rules" },
+    "K8s::Grafana::GrafanaContactPoint": { field: "receivers", what: "Grafana contact point receivers" },
+    "K8s::Grafana::GrafanaNotificationPolicy": { field: "route", what: "a Grafana notification policy" },
+    "K8s::Grafana::GrafanaMuteTiming": { field: "time_intervals", what: "Grafana mute timing intervals" },
+    "K8s::Grafana::GrafanaNotificationTemplate": { field: "template", what: "a Grafana notification template" },
+};
+function looksLikeRuleGroups(groups) {
+    return Array.isArray(groups) && groups.length > 0 && groups.every((g) => isObject(g) && typeof g.name === "string" && Array.isArray(g.rules));
+}
+/** Whose content a ConfigMap value looks like, by the conventions manifests follow. */
+function hintFor(key, doc, labels) {
+    if (!isObject(doc))
+        return undefined;
+    if (Array.isArray(doc.panels) && (GRAFANA_DASHBOARD_LABEL in labels || key.endsWith(".json"))) {
+        return { lexicon: "grafana", what: "a Grafana dashboard" };
+    }
+    const v2Dashboard = (doc.kind === "Dashboard" && typeof doc.apiVersion === "string" && doc.apiVersion.startsWith("dashboard.grafana.app/")) ||
+        (isObject(doc.elements) && isObject(doc.layout));
+    if (v2Dashboard && (GRAFANA_DASHBOARD_LABEL in labels || key.endsWith(".json"))) {
+        return { lexicon: "grafana", what: "a Grafana dashboard" };
+    }
+    if (isObject(doc.service) && isObject(doc.service.pipelines)) {
+        return { lexicon: "otel", what: "an OpenTelemetry Collector config" };
+    }
+    if (looksLikeRuleGroups(doc.groups))
+        return { lexicon: "prometheus", what: "a Prometheus rule file" };
+    if ((isObject(doc.route) || Array.isArray(doc.receivers)) && !("apiVersion" in doc) && !("kind" in doc)) {
+        return { lexicon: "prometheus", what: "an Alertmanager config" };
+    }
+    return undefined;
+}
+function stringLabels(metadata) {
+    const labels = isObject(metadata) && isObject(metadata.labels) ? metadata.labels : {};
+    return Object.fromEntries(Object.entries(labels).filter((e) => typeof e[1] === "string"));
+}
+/**
+ * Offer the embedded content of one resource to `embedded`, replacing each
+ * value an owner imports with the reference it returns. `properties` is the
+ * resource's IR properties, changed in place (with fresh copies of the
+ * objects on the way down).
+ */
+export function delegateEmbedded(type, kind, properties, embedded) {
+    const metadata = properties.metadata;
+    const name = isObject(metadata) && typeof metadata.name === "string" ? metadata.name : kind.toLowerCase();
+    const labels = stringLabels(metadata);
+    if (type === "K8s::Core::ConfigMap" && isObject(properties.data)) {
+        const keys = Object.keys(properties.data);
+        const data = { ...properties.data };
+        for (const key of keys) {
+            const text = data[key];
+            if (typeof text !== "string")
+                continue;
+            const doc = embeddedDocument(text);
+            if (!isObject(doc))
+                continue;
+            const ref = embedded.resolve({
+                host: "k8s",
+                hostType: type,
+                location: `ConfigMap ${name} data[${JSON.stringify(key)}]`,
+                directory: keys.length === 1 ? name : `${name}-${key.replace(/\.[^.]*$/, "")}`,
+                text,
+                document: doc,
+                labels,
+                expectedOwner: hintFor(key, doc, labels),
+            });
+            if (ref)
+                data[key] = ref;
+        }
+        properties.data = data;
+        return;
+    }
+    if (type === "K8s::Grafana::GrafanaDashboard" && isObject(properties.spec) && typeof properties.spec.json === "string") {
+        const text = properties.spec.json;
+        const doc = embeddedDocument(text);
+        if (!isObject(doc))
+            return;
+        const ref = embedded.resolve({
+            host: "k8s",
+            hostType: type,
+            location: `GrafanaDashboard ${name} spec.json`,
+            directory: name,
+            text,
+            document: doc,
+            labels,
+            expectedOwner: { lexicon: "grafana", what: "a Grafana dashboard" },
+        });
+        if (ref)
+            properties.spec = { ...properties.spec, json: ref };
+        return;
+    }
+    // A GrafanaNotificationPolicyRoute's spec is the route itself, so the whole spec is offered (as `route`) and replaced.
+    if (type === "K8s::Grafana::GrafanaNotificationPolicyRoute" && isObject(properties.spec) && typeof properties.spec.receiver === "string") {
+        const ref = embedded.resolve({
+            host: "k8s",
+            hostType: type,
+            location: `${kind} ${name} spec`,
+            directory: name,
+            document: { route: properties.spec },
+            select: "route",
+            labels,
+            expectedOwner: { lexicon: "grafana", what: "a Grafana notification policy route" },
+        });
+        if (ref)
+            properties.spec = ref;
+        return;
+    }
+    const alerting = GRAFANA_ALERTING_FIELDS[type];
+    if (alerting && isObject(properties.spec) && properties.spec[alerting.field] !== undefined) {
+        const spec = properties.spec;
+        const ref = embedded.resolve({
+            host: "k8s",
+            hostType: type,
+            location: `${kind} ${name} spec.${alerting.field}`,
+            directory: name,
+            document: spec,
+            select: alerting.field,
+            labels,
+            expectedOwner: { lexicon: "grafana", what: alerting.what },
+        });
+        if (ref)
+            properties.spec = { ...spec, [alerting.field]: ref };
+        return;
+    }
+    // The CR holds the config as an object, so the owner is asked for an object (`select: "config"`,
+    // answered with `collectorConfig([...])`) rather than for text, which would put a string where the CRD wants a map.
+    if (type === "K8s::OpenTelemetry::OpenTelemetryCollector" && isObject(properties.spec) && isObject(properties.spec.config)) {
+        const spec = properties.spec;
+        const raw = isObject(metadata) && isObject(metadata.annotations) ? metadata.annotations[OTEL_HEADER_ANNOTATION] : undefined;
+        const header = typeof raw === "string" ? raw.split("\n").filter((l) => l.length > 0) : [];
+        const ref = embedded.resolve({
+            host: "k8s",
+            hostType: type,
+            location: `OpenTelemetryCollector ${name} spec.config`,
+            directory: name,
+            document: { config: spec.config, header },
+            select: "config",
+            labels,
+            expectedOwner: { lexicon: "otel", what: "an OpenTelemetry Collector config" },
+        });
+        if (ref)
+            properties.spec = { ...spec, config: ref };
+        return;
+    }
+    if (type === "K8s::Monitoring::PrometheusRule" && isObject(properties.spec) && Array.isArray(properties.spec.groups)) {
+        const groups = properties.spec.groups;
+        const ref = embedded.resolve({
+            host: "k8s",
+            hostType: type,
+            location: `PrometheusRule ${name} spec.groups`,
+            directory: name,
+            document: { groups },
+            select: "groups",
+            labels,
+            expectedOwner: { lexicon: "prometheus", what: "Prometheus rule groups" },
+        });
+        if (ref)
+            properties.spec = { ...properties.spec, groups: ref };
+    }
+}

package/dist/import/generator.js

@@ -0,0 +1,288 @@
+/**
+ * TypeScript code generator for Kubernetes import.
+ *
+ * Converts a TemplateIR (from parsed K8s manifests) into TypeScript
+ * source code using the @intentius/chant-lexicon-k8s constructors.
+ */
+import { EmbeddedImportScope, isEmbeddedReference, renderEmbeddedReference, } from "@intentius/chant/import/embedded";
+const IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+/** An object key as TypeScript: bare when it is an identifier, quoted otherwise (`"config.yaml"`, `"app.kubernetes.io/name"`). */
+function propertyKey(key) {
+    return IDENT.test(key) ? key : JSON.stringify(key);
+}
+/**
+ * Map K8s entity types to their constructor class names.
+ */
+const TYPE_TO_CLASS = {
+    // Core
+    "K8s::Core::Pod": "Pod",
+    "K8s::Core::Service": "Service",
+    "K8s::Core::ConfigMap": "ConfigMap",
+    "K8s::Core::Secret": "Secret",
+    "K8s::Core::Namespace": "Namespace",
+    "K8s::Core::ServiceAccount": "ServiceAccount",
+    "K8s::Core::PersistentVolume": "PersistentVolume",
+    "K8s::Core::PersistentVolumeClaim": "PersistentVolumeClaim",
+    "K8s::Core::Endpoints": "Endpoints",
+    "K8s::Core::LimitRange": "LimitRange",
+    "K8s::Core::ResourceQuota": "ResourceQuota",
+    // Apps
+    "K8s::Apps::Deployment": "Deployment",
+    "K8s::Apps::StatefulSet": "StatefulSet",
+    "K8s::Apps::DaemonSet": "DaemonSet",
+    "K8s::Apps::ReplicaSet": "ReplicaSet",
+    // Batch
+    "K8s::Batch::Job": "Job",
+    "K8s::Batch::CronJob": "CronJob",
+    // Networking
+    "K8s::Networking::Ingress": "Ingress",
+    "K8s::Networking::NetworkPolicy": "NetworkPolicy",
+    "K8s::Networking::IngressClass": "IngressClass",
+    // RBAC
+    "K8s::Rbac::Role": "Role",
+    "K8s::Rbac::ClusterRole": "ClusterRole",
+    "K8s::Rbac::RoleBinding": "RoleBinding",
+    "K8s::Rbac::ClusterRoleBinding": "ClusterRoleBinding",
+    // Autoscaling
+    "K8s::Autoscaling::HorizontalPodAutoscaler": "HorizontalPodAutoscaler",
+    // Policy
+    "K8s::Policy::PodDisruptionBudget": "PodDisruptionBudget",
+    // Storage
+    "K8s::Storage::StorageClass": "StorageClass",
+};
+/**
+ * Properties that reference known property entity constructors.
+ * Key: property name found in K8s specs → Value: constructor class name.
+ */
+const PROPERTY_CONSTRUCTORS = {
+    containers: "Container",
+    initContainers: "Container",
+    ephemeralContainers: "EphemeralContainer",
+    volumes: "Volume",
+    volumeMounts: "VolumeMount",
+    ports: "ContainerPort",
+    env: "EnvVar",
+    envFrom: "EnvFromSource",
+    resources: "ResourceRequirements",
+    securityContext: "SecurityContext",
+    podSecurityContext: "PodSecurityContext",
+    livenessProbe: "Probe",
+    readinessProbe: "Probe",
+    startupProbe: "Probe",
+    selector: "LabelSelector",
+    template: "PodTemplateSpec",
+    strategy: "DeploymentStrategy",
+    affinity: "Affinity",
+    tolerations: "Toleration",
+    topologySpreadConstraints: "TopologySpreadConstraint",
+    rules: "IngressRule",
+    tls: "IngressTLS",
+    ingress: "NetworkPolicyIngressRule",
+    egress: "NetworkPolicyEgressRule",
+};
+/**
+ * Service port properties need distinct handling since K8s uses "ports"
+ * for both ContainerPort and ServicePort depending on the parent resource.
+ */
+const SERVICE_PORT_TYPES = new Set([
+    "K8s::Core::Service",
+]);
+/**
+ * A Role's and a ClusterRole's top-level `rules` are PolicyRules, not the
+ * IngressRules {@link PROPERTY_CONSTRUCTORS} maps `rules` to. Since the
+ * property classes carry their members (chant #3093), an IngressRule built
+ * from `apiGroups`/`verbs` no longer type-checks.
+ */
+const POLICY_RULE_TYPES = new Set([
+    "K8s::Rbac::Role",
+    "K8s::Rbac::ClusterRole",
+]);
+/** The constructor for `key` on a resource of `parentType`. */
+function constructorFor(key, parentType) {
+    if (key === "rules" && POLICY_RULE_TYPES.has(parentType))
+        return "PolicyRule";
+    return PROPERTY_CONSTRUCTORS[key];
+}
+/**
+ * Generate TypeScript source code from a Kubernetes IR.
+ */
+export class K8sGenerator {
+    constructor() {
+        /** The imports for embedded content the current `generate()` call references (#2962). */
+        this.scope = new EmbeddedImportScope("");
+    }
+    generate(ir) {
+        const lines = [];
+        // Collect which constructors are needed
+        const usedConstructors = new Set();
+        for (const resource of ir.resources) {
+            const cls = this.resolveClass(resource.type);
+            if (cls)
+                usedConstructors.add(cls);
+            // Check properties for nested constructors
+            this.collectNestedConstructors(resource.properties, usedConstructors, resource.type);
+        }
+        // Names the embedded content's imports must not take: every constructor this file may use, and its exports.
+        this.scope = new EmbeddedImportScope("", [
+            ...usedConstructors,
+            ...Object.values(PROPERTY_CONSTRUCTORS),
+            "ServicePort",
+            "PolicyRule",
+            ...ir.resources.map((r) => r.logicalId),
+        ]);
+        // Emit namespaces as comments
+        if (ir.metadata?.namespaces && Array.isArray(ir.metadata.namespaces)) {
+            lines.push(`// Namespaces: ${ir.metadata.namespaces.join(", ")}`);
+            lines.push("");
+        }
+        // Emit resources
+        for (const resource of ir.resources) {
+            const cls = this.resolveClass(resource.type);
+            if (!cls) {
+                lines.push(`// TODO: unsupported type ${resource.type} (${resource.logicalId})`);
+                lines.push("");
+                continue;
+            }
+            const varName = resource.logicalId;
+            const propsStr = this.emitProps(resource.properties, 1, resource.type);
+            lines.push(`export const ${varName} = new ${cls}(${propsStr});`);
+            lines.push("");
+        }
+        // Import statements: the k8s constructors, then what embedded content references.
+        // The constructors are read back from what was emitted (string literals
+        // taken out), so a nested one the walk above does not reach (a
+        // container's env) is imported too.
+        const code = lines.join("\n").replace(/"(?:[^"\\\n]|\\.)*"/g, '""');
+        for (const m of code.matchAll(/\bnew ([A-Z][A-Za-z0-9_]*)\(/g))
+            usedConstructors.add(m[1]);
+        const imports = [...usedConstructors].sort().join(", ");
+        const head = [`import { ${imports} } from "@intentius/chant-lexicon-k8s";`, ...this.scope.lines(), ""];
+        return [{ path: "main.ts", content: [...head, ...lines].join("\n") }];
+    }
+    /**
+     * Resolve a K8s type name to a constructor class name.
+     * Falls back to extracting the last segment of the type.
+     */
+    resolveClass(type) {
+        if (TYPE_TO_CLASS[type])
+            return TYPE_TO_CLASS[type];
+        // Fallback: extract Kind from "K8s::Group::Kind"
+        const parts = type.split("::");
+        if (parts.length === 3 && parts[0] === "K8s")
+            return parts[2];
+        return undefined;
+    }
+    collectNestedConstructors(props, used, parentType) {
+        for (const [key, value] of Object.entries(props)) {
+            if (value === undefined || value === null)
+                continue;
+            // Special case: "ports" on Service resources → ServicePort
+            if (key === "ports" && SERVICE_PORT_TYPES.has(parentType)) {
+                if (Array.isArray(value))
+                    used.add("ServicePort");
+                continue;
+            }
+            const constructor = constructorFor(key, parentType);
+            if (!constructor)
+                continue;
+            if (Array.isArray(value)) {
+                used.add(constructor);
+            }
+            else if (typeof value === "object") {
+                used.add(constructor);
+            }
+            // Recurse into nested specs (e.g., template.spec.containers)
+            if (typeof value === "object" && !Array.isArray(value)) {
+                this.collectNestedConstructors(value, used, parentType);
+            }
+        }
+        // Recurse into spec if present
+        if (props.spec && typeof props.spec === "object" && !Array.isArray(props.spec)) {
+            this.collectNestedConstructors(props.spec, used, parentType);
+        }
+    }
+    emitProps(props, depth, parentType) {
+        const indent = "  ".repeat(depth);
+        const innerIndent = "  ".repeat(depth + 1);
+        const entries = [];
+        for (const [key, value] of Object.entries(props)) {
+            if (value === undefined || value === null)
+                continue;
+            const emitted = this.emitValue(key, value, depth + 1, parentType);
+            entries.push(`${innerIndent}${propertyKey(key)}: ${emitted},`);
+        }
+        if (entries.length === 0)
+            return "{}";
+        return `{\n${entries.join("\n")}\n${indent}}`;
+    }
+    emitValue(key, value, depth, parentType) {
+        if (value === null || value === undefined)
+            return "undefined";
+        if (isEmbeddedReference(value))
+            return renderEmbeddedReference(value, this.scope, depth * 2);
+        // Special case: "ports" on Service → ServicePort constructor
+        if (key === "ports" && SERVICE_PORT_TYPES.has(parentType) && Array.isArray(value)) {
+            return this.emitConstructorArray("ServicePort", value, depth, parentType);
+        }
+        // Check if this key maps to a property constructor
+        const constructor = constructorFor(key, parentType);
+        if (constructor) {
+            // Array of constructors (containers, volumes, ports, env, etc.)
+            if (Array.isArray(value)) {
+                return this.emitConstructorArray(constructor, value, depth, parentType);
+            }
+            // Single constructor (securityContext, resources, selector, template, strategy, etc.)
+            if (typeof value === "object") {
+                const propsStr = this.emitProps(value, depth, parentType);
+                return `new ${constructor}(${propsStr})`;
+            }
+        }
+        return this.emitLiteral(value, depth, parentType);
+    }
+    emitConstructorArray(constructor, items, depth, parentType) {
+        const indent = "  ".repeat(depth);
+        const innerIndent = "  ".repeat(depth + 1);
+        const emitted = items.map((item) => {
+            if (typeof item === "object" && item !== null && !Array.isArray(item)) {
+                const propsStr = this.emitProps(item, depth + 1, parentType);
+                return `new ${constructor}(${propsStr})`;
+            }
+            return JSON.stringify(item);
+        });
+        if (emitted.length === 1 && emitted[0].length < 60) {
+            return `[${emitted[0]}]`;
+        }
+        return `[\n${emitted.map((e) => `${innerIndent}${e},`).join("\n")}\n${indent}]`;
+    }
+    emitLiteral(value, depth, parentType) {
+        if (value === null || value === undefined)
+            return "undefined";
+        if (isEmbeddedReference(value))
+            return renderEmbeddedReference(value, this.scope, depth * 2);
+        if (typeof value === "string")
+            return JSON.stringify(value);
+        if (typeof value === "number" || typeof value === "boolean")
+            return String(value);
+        if (Array.isArray(value)) {
+            if (value.length === 0)
+                return "[]";
+            const items = value.map((item) => this.emitLiteral(item, depth + 1, parentType));
+            const oneLine = `[${items.join(", ")}]`;
+            if (oneLine.length < 80)
+                return oneLine;
+            const indent = "  ".repeat(depth);
+            const innerIndent = "  ".repeat(depth + 1);
+            return `[\n${items.map((i) => `${innerIndent}${i},`).join("\n")}\n${indent}]`;
+        }
+        if (typeof value === "object") {
+            const entries = Object.entries(value);
+            if (entries.length === 0)
+                return "{}";
+            const indent = "  ".repeat(depth);
+            const innerIndent = "  ".repeat(depth + 1);
+            const items = entries.map(([k, v]) => `${innerIndent}${propertyKey(k)}: ${this.emitLiteral(v, depth + 1, parentType)},`);
+            return `{\n${items.join("\n")}\n${indent}}`;
+        }
+        return String(value);
+    }
+}

package/dist/import/live-export.js

@@ -0,0 +1,85 @@
+import { hasOwnershipMarker, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
+import { K8sParser } from "./parser.js";
+/**
+ * Server-managed metadata fields that the API server fills in. They are not
+ * part of the declared shape and would only add noise to regenerated source,
+ * so they are stripped unless `verbatim` is set.
+ */
+const SERVER_METADATA_FIELDS = [
+    "managedFields",
+    "uid",
+    "resourceVersion",
+    "generation",
+    "creationTimestamp",
+    "selfLink",
+    "ownerReferences",
+    "finalizers",
+];
+/** Annotations the cluster writes back that are not authored config. */
+const SERVER_ANNOTATIONS = [
+    "kubectl.kubernetes.io/last-applied-configuration",
+    "deployment.kubernetes.io/revision",
+];
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/**
+ * Strip `status`, `managedFields`, and other server-written fields to reach the
+ * declared shape. Returns a new object; the input is not mutated.
+ */
+export function stripServerFields(obj) {
+    const clone = JSON.parse(JSON.stringify(obj));
+    delete clone.status;
+    if (isRecord(clone.metadata)) {
+        const md = clone.metadata;
+        for (const f of SERVER_METADATA_FIELDS)
+            delete md[f];
+        if (isRecord(md.annotations)) {
+            for (const a of SERVER_ANNOTATIONS)
+                delete md.annotations[a];
+            if (Object.keys(md.annotations).length === 0)
+                delete md.annotations;
+        }
+    }
+    return clone;
+}
+/**
+ * Build full-fidelity export IR from a list of live Kubernetes objects (the
+ * `items` of a `kubectl get -o json` List). Reuses the import K8sParser by
+ * feeding it the cleaned objects as JSON documents — JSON is valid YAML, so no
+ * separate serializer is needed. Pure: all I/O stays in the caller.
+ *
+ * The result's `reparse(context)` parses the same objects again with a
+ * `ParseContext`, so `chant import --from` hands embedded content (a
+ * collector config in a ConfigMap, a PrometheusRule's groups) to the lexicon
+ * that owns it, as file import does (#2995).
+ */
+export function buildExportFromObjects(objects, opts = {}) {
+    const owning = opts.owned
+        ? objects.filter((o) => {
+            if (!isRecord(o))
+                return false;
+            const labels = isRecord(o.metadata) ? o.metadata.labels : undefined;
+            return hasOwnershipMarker(labels, LABEL_OWNERSHIP_KEYS);
+        })
+        : objects;
+    const cleaned = owning
+        .filter(isRecord)
+        .map((o) => (opts.verbatim ? o : stripServerFields(o)));
+    const content = cleaned.map((o) => JSON.stringify(o, null, 2)).join("\n---\n");
+    const parse = (context) => select(new K8sParser().parse(content, context), opts.selector);
+    return { ...parse(), reparse: (context) => parse(context) };
+}
+function select(ir, selector) {
+    if (!selector || (selector.type === undefined && selector.name === undefined)) {
+        return ir;
+    }
+    return {
+        ...ir,
+        resources: ir.resources.filter((r) => {
+            const liveName = r.metadata?.originalName ?? r.logicalId;
+            return ((selector.type === undefined || r.type === selector.type) &&
+                (selector.name === undefined || liveName === selector.name));
+        }),
+    };
+}